The Automatic Translator with Google Translate plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the custom font setting. Authenticated users with administrator privileges can inject arbitrary scripts that persist in the database and execute in the context of users visiting the compromised pages. This issue affects all versions up to and including 1.5.4, specifically in multi-site environments or where unfiltered_html is disabled. The vulnerability requires high privileges and has a network attack vector with no user interaction needed once the malicious script is stored.

An attacker with administrator-level access can inject persistent malicious scripts into pages via the custom font setting. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or session hijacking limited to the scope of the injected script. The impact is limited by the requirement for administrator privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

No official patch or fix is currently documented for this vulnerability. Users should verify vendor advisories for updates. Until a fix is available, restrict administrator access to trusted users only and consider enabling unfiltered_html if feasible. Monitor plugin updates closely and apply any future patches promptly. Since this affects only multi-site installations or those with unfiltered_html disabled, consider these configurations carefully.